Prototype silent authentication #992

lebaudantoine · 2025-05-21T14:21:03Z

This contribution is totally draft, and waiting for peer-programming with @AntoLC .
Requested by @virgile-dev, I propose a prototype of the silent login authentication implemented in La Suite Django package.

virgile-dev · 2025-05-22T14:52:56Z

Nice thank you @lebaudantoine !
@AntoLC this is a huge win for users, let's get to it when you or @lunika get a bit of bandwith

src/frontend/apps/impress/src/features/auth/api/useAuthQuery.tsx

src/frontend/apps/impress/src/features/auth/components/Auth.tsx

src/frontend/apps/impress/src/pages/docs/[id]/index.tsx

src/frontend/apps/impress/src/features/auth/api/useAuthQuery.tsx

lebaudantoine · 2025-05-24T22:01:50Z

current UX (insufficient RAM on my computer are negatively impacting the current UX.)

wip.mov

lebaudantoine · 2025-05-24T22:05:12Z

While reducing the number of requests to the /me endpoint, I discovered a race condition. React Query is designed to execute a single /me query, from my understanding, but there's a race condition occurring between the Auth component and the Language Picker component, which triggers two simultaneous requests.

Stop retry attempts when receiving 401 Unauthorized from /me endpoint since this clearly indicates authentication status. The original purpose of the /me call is simply to determine if user is authenticated, and a 401 provides sufficient information. Prevents unnecessary network requests caused by React Query's automatic retry behavior when re-raising exceptions, which was hiding the 401 status. Improves performance and reduces server load during authentication failures.

Use returnTo capability to pass target URL during authentication, eliminating redundant renders when returning to app. Work around Next.js router limitations (can't pass data when replacing URL) by adding temporary target parameter. Discovered issue: 401 responses on document fetch trigger retry loop instead of redirecting to login. Will address in subsequent commits.

Remove variable that is no longer referenced in the codebase to improve code cleanliness and reduce potential confusion.

Reduce unnecessary fetch requests when retrieving documents with permission or authentication issues. Previous implementation was triggering multiple document requests despite having sufficient error information from initial attempt to determine appropriate user redirection. Additionally, fix issue where resetting the auth cache was triggering redundant authentication verification requests. The responsibility for checking auth status should belong to the 401 page component on mount, rather than being triggered by cache resets during error handling. Known limitations: - Not waiting for async function completion makes code harder to maintain - Added loading spinner as temporary solution to prevent UI flicker - Future improvement should implement consistent error-based redirects rather than rendering error messages directly on document page

Add initial naive implementation of silent login functionality using prompt=None parameter to request OIDC provider to skip login screen and return proper HTTP error response instead.

Update APIError message that incorrectly mentioned document when configuration fetching fails.

lebaudantoine · 2025-05-24T22:25:00Z

We should add a configuration, I propose IS_SILENT_LOGIN_ENABLED. People self-hosting docs could enable the silent login, if their OIDC provider supports the prompt parameter.

lebaudantoine · 2025-05-24T22:25:51Z

To avoid spamming the user with too many redirections, in my code, the default retry silent login is every hour.

virgile-dev · 2025-05-25T07:43:20Z

current UX (insufficient RAM on my computer are negatively impacting the current UX.)
wip.mov

Hey @lebaudantoine thanks for the video.
Ideally if a user is loggued in he should see his documents and not the landing page. Is that something we can acheive with the right callback maybe ?

lebaudantoine · 2025-05-25T08:10:36Z

@virgile-dev I've not modified this behavior, it should be still functional. In the video, I'm logged out. The video illustrates that silent login is tried once per 1hour

lunika · 2025-06-02T14:58:33Z

src/frontend/apps/impress/src/core/config/api/useConfig.tsx

@@ -38,7 +38,10 @@ export const getConfig = async (): Promise<ConfigResponse> => {
  const response = await fetchAPI(`config/`);

  if (!response.ok) {
-    throw new APIError('Failed to get the doc', await errorCauses(response));
+    throw new APIError(
+      'Failed to get the configurations',


Suggested change

'Failed to get the configurations',

'Failed to get the configuration',

AntoLC · 2025-06-04T15:05:31Z

src/frontend/apps/impress/src/features/auth/api/useAuthQuery.tsx

+    attemptSilentLogin(3600);
+
+    while (window.location.href === currentLocation) {
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }


If attemptSilentLogin fails, it seems to stay blocked in the loop.

AntoLC

I have a problem with the redirection after being login again, maybe I missed something ?

scrnli_MH6SMWOL44sxmh.webm

Actually I can see the test e2e got the problem as well:

AntoLC · 2025-06-04T15:14:06Z

src/backend/impress/settings.py

+    OIDC_AUTHENTICATE_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationRequestView"
+    OIDC_CALLBACK_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationCallbackView"


You should add them in /docs/env.md.

AntoLC · 2025-06-04T15:14:34Z

src/backend/impress/settings.py

+    OIDC_REDIRECT_FIELD_NAME = values.Value(
+        "returnTo", environ_name="OIDC_REDIRECT_FIELD_NAME", environ_prefix=None
+    )


Same, should be added in /docs/env.md.

AntoLC · 2025-06-04T15:43:50Z

src/frontend/apps/impress/src/features/auth/api/useAuthQuery.tsx

+
+  if (!response.ok && response.status == 401 && canAttemptSilentLogin()) {
+    const currentLocation = window.location.href;
+    attemptSilentLogin(3600);


It should be in const in the conf I think, for everybody to know that it is something that we could configure, wdyt?

AntoLC · 2025-06-04T15:53:11Z

src/frontend/apps/impress/src/features/auth/utils.ts

+export const gotoLogin = (returnTo = '/', isSilent = false) => {
+  const authenticateUrl =
+    LOGIN_URL +
+    `?silent=${encodeURIComponent(isSilent)}&returnTo=${window.location.origin + returnTo}`;


The redirection does not seems to work, returnTo seems to be set though.

lebaudantoine force-pushed the poc-silent-login branch from e1a5fc1 to a4b0345 Compare May 21, 2025 16:56

lebaudantoine commented May 23, 2025

View reviewed changes

src/frontend/apps/impress/src/features/auth/api/useAuthQuery.tsx Outdated Show resolved Hide resolved

lebaudantoine commented May 23, 2025

View reviewed changes

src/frontend/apps/impress/src/features/auth/components/Auth.tsx Outdated Show resolved Hide resolved

lebaudantoine commented May 23, 2025

View reviewed changes

src/frontend/apps/impress/src/pages/docs/[id]/index.tsx Outdated Show resolved Hide resolved

lebaudantoine commented May 23, 2025

View reviewed changes

src/frontend/apps/impress/src/features/auth/api/useAuthQuery.tsx Outdated Show resolved Hide resolved

lebaudantoine force-pushed the poc-silent-login branch 5 times, most recently from 0498ae1 to 53796bc Compare May 24, 2025 21:49

lebaudantoine added 6 commits May 25, 2025 00:09

🔥(frontend) delete unused variable

f66a8e3

Remove variable that is no longer referenced in the codebase to improve code cleanliness and reduce potential confusion.

🚸(auth) implement first draft of silent login with prompt=None

ec663b6

Add initial naive implementation of silent login functionality using prompt=None parameter to request OIDC provider to skip login screen and return proper HTTP error response instead.

🩹(frontend) correct misleading error message for config fetch failure

4cecfec

Update APIError message that incorrectly mentioned document when configuration fetching fails.

lebaudantoine force-pushed the poc-silent-login branch from 62d6689 to 4cecfec Compare May 24, 2025 22:10

lunika approved these changes Jun 2, 2025

View reviewed changes

AntoLC reviewed Jun 4, 2025

View reviewed changes

lunika self-requested a review June 5, 2025 07:29

	'Failed to get the configurations',
	'Failed to get the configuration',

		OIDC_AUTHENTICATE_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationRequestView"
		OIDC_CALLBACK_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationCallbackView"

Prototype silent authentication #992

Are you sure you want to change the base?

Prototype silent authentication #992

Uh oh!

Conversation

lebaudantoine commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

virgile-dev commented May 22, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lebaudantoine commented May 24, 2025

Uh oh!

lebaudantoine commented May 24, 2025

Uh oh!

lebaudantoine commented May 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lebaudantoine commented May 24, 2025

Uh oh!

virgile-dev commented May 25, 2025

Uh oh!

lebaudantoine commented May 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lunika Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

AntoLC Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

AntoLC left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AntoLC Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

AntoLC Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

AntoLC Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

AntoLC Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lebaudantoine commented May 21, 2025 •

edited

Loading

lebaudantoine commented May 24, 2025 •

edited

Loading

lebaudantoine commented May 25, 2025 •

edited

Loading

AntoLC left a comment •

edited

Loading